How to enable the check for Allowed Tenants on Container Apps built-in Authentication

Question

in Container App, there is now the ability to enable Built-in Authentication (similar to what has been available for some time now in App Services)

When adding the Microsoft Identity Provider, we can define several Additional Checks:

• Client application requirement
• Identity requirement

However in App Services, there is a 3rd check available: Allowed tenants

my question is the following: How can I enable an "Allowed Tenant" check during the Built-in Authentication on Container Apps...to limit access to my app to Users from a list of specific tenants.

Thanks

Answer 1

@Gaetan Willems ,
Welcome to Microsoft Q&A Platform!

Thanks for reaching out your query on limiting access to container app to Users from a list of specific tenants.

The built-in authentication in Azure Container Apps is designed for simplicity and flexibility, meaning that it does not have direct configuration for restricting access to specific tenants (as you would with a more complex identity solution).

If your tenants use Microsoft Entra ID as the identity provider, you can configure Container Apps to use the /common endpoint to validate user tokens. This ensures that, regardless of the user's Microsoft Entra tenant, their tokens are validated and accepted.

You could refer the below documentation on the same
https://learn.microsoft.com/en-us/azure/architecture/guide/multitenant/service/container-apps#managed-identities

https://learn.microsoft.com/en-us/entra/identity-platform/howto-restrict-your-app-to-a-set-of-users

Hope this helps. Do let us know if you any further queries.

---

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.